Detections
Analytics
Atlassian Confluence VelocityServlet Error Page XSS
medium Nessus Plugin ID 62356
Language:
Synopsis
The remote web server hosts a web application that is affected by a cross-site scripting vulnerability.Description
The remote server hosts an install of Atlassian Confluence that is affected by a cross-site scripting vulnerability related to the 'ConfluenceVelocityServlet.class' and error pages.User-supplied input in a URL is not validated properly before being returned in an error page. This can result in an attacker-controlled script running in the user's browser.
Solution
Apply the vendor patches or update to Confluence version 4.1.9 or later.See Also
https://seclists.org/bugtraq/2012/Sep/68
Plugin Details
Severity: Medium
ID: 62356
File Name: confluence_error_page_xss.nasl
Version: 1.10
Type: remote
Family: CGI abuses : XSS
Published: 9/27/2012
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.6
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:atlassian:confluence
Required KB Items: www/confluence
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 9/11/2011
Vulnerability Publication Date: 9/11/2011
Reference Information
BID: 55509